Privacy Policy
Version 1.0. Effective from: 25 October 2026.
This policy explains what personal data we collect, why, who receives it, how long we keep it, and the rights you and your parent or guardian have over it.
1. Who we are
forBio Academy is an initiative of PT Forsains Edutech, Jl. Gadung No. 8, Denpasar, Indonesia ("forBio", "we"). PT Forsains Edutech is the data controller for forBio's services.
Person responsible for data protection: Prakasa Wiprayoga, owner of forBio Academy.
Contact for any data request: forbio.academy@gmail.com or admin@forsains-edu.com.
2. Data we collect
- Student identity. What it is: Full name, forBio student ID. Where it comes from: Registration form, then uploaded by an admin.
- Student contact. What it is: Email (one is the login email), phone number if given. Where it comes from: Registration form.
- School. What it is: School name, school year, province. Where it comes from: Registration form.
- Parent, guardian or teacher contact. What it is: Name, relationship to the student, phone number. Where it comes from: Registration form.
- Parent or guardian consent. What it is: Date of consent, parent or guardian name and number. Where it comes from: Registration form.
- Enrolment. What it is: Batch, classes taken, participant status, internal admin notes. Where it comes from: Admin.
- Learning results. What it is: Evaluation scores, per-question scores, rank calculated from scores, tutor notes if any. Where it comes from: Admin uploads scores.
- Student portal activity. What it is: When a student opens evaluation results, login session (valid 7 days). Where it comes from: Student portal.
- Security. What it is: Login attempt log (email and a disguised IP address), admin action log. Where it comes from: Automatic.
- Payment. What it is: Transfer receipt (not stored on the website). Where it comes from: WhatsApp or form.
- Messages. What it is: Number and message content sent to admins or class groups. Where it comes from: WhatsApp.
- Live classes. What it is: Display name and chat in Zoom; recordings contain only the tutor's voice and screen. Where it comes from: Zoom.
- Kick-Off Class. What it is: Data entered in the Kick-Off registration form. Where it comes from: Registration form.
- Scholarship. What it is: Data requested in the scholarship form. Where it comes from: Scholarship form.
- Promotion. What it is: Name, photo and competition results, only with separate consent. Where it comes from: Student and parent or guardian.
We do not collect date of birth, gender, home address or parents' occupation. forBio Lab simulations store no data about their use.
The site uses only three necessary cookies: forbio-lang (language choice), forbio-student-auth and forbio-admin-auth (login). We use no analytics, advertising or third-party trackers.
3. Purposes and legal basis
- Processing registration and running classes. Data: Identity, school, contact. Legal basis: Performance of a contract.
- Student portal account and showing results. Data: Email, learning results, portal activity. Legal basis: Performance of a contract.
- Contacting students and parents or guardians about classes. Data: Student and parent or guardian contact. Legal basis: Performance of a contract.
- Evaluations, ranks and learning reports. Data: Learning results. Legal basis: Performance of a contract.
- Scholarship selection. Data: Scholarship form answers. Legal basis: Consent.
- Promotion (winners' names, testimonials, photos). Data: Name, photo, competition results. Legal basis: Separate, optional consent.
- Account security and logging admin actions. Data: Security logs. Legal basis: Legitimate interest.
Ranks are calculated automatically from evaluation scores and are not used for any other decision about a student. We do not sell personal data.
4. Children under 18
Most of our students are under 18. We process their data only with a parent's or guardian's consent, given through a required checkbox in the registration, Kick-Off Class and scholarship forms:
"I am the parent or guardian, or have the parent's or guardian's permission, and agree to forBio's Privacy Policy."
The consent is recorded with the form response: date, parent or guardian name and number. Students aged 18 or over consent themselves.
5. Recipients and storage location
Only forBio's owner and appointed academic staff can see the data. Every admin uses their own account with permissions for their role and must use two-step verification.
We use the services below. Most of them store data outside Indonesia:
- Supabase. Used for: Database and student portal login. Data location: Singapore.
- Vercel. Used for: Running the website. Data location: Singapore; public pages through a global network.
- Google (Forms, Sheets, Drive). Used for: Registration and admin working files. Data location: Google's global servers.
- WhatsApp (Meta). Used for: Class communication. Data location: Meta's global servers.
- Zoom. Used for: Live classes and recordings. Data location: Zoom's servers.
- Resend. Used for: Sending invitation and password reset emails. Data location: Outside Indonesia.
- Bank. Used for: Receiving payments. Data location: Indonesia.
Transfers outside Indonesia are protected by the providers' data processing agreements where available, each provider's terms and privacy policy, and the safeguards in section 8. This policy is our notice of those transfers.
6. Retention
- Account, student data, scores and ranks: While the student takes part in forBio; deleted 5 years after the last batch taken, or sooner on request.
- Registration form responses: Same as student data.
- Pending upload rows: 30 days, then deleted automatically.
- Security and admin action logs: 1 year.
- Encrypted database backups: Made weekly, kept 3 months.
- Payment receipts: 10 years, under tax rules.
- Class WhatsApp groups: Archived or closed 1 year after the batch ends.
- Zoom class recordings and chat: Until the olympiad the class prepares for has ended.
Deleted data remains in older backups until they expire, at most 3 months.
7. Your rights and your parent's or guardian's
You have the right to:
- be informed and access your personal data, including a copy;
- correct wrong or incomplete data;
- ask for deletion;
- withdraw consent;
- ask for processing to be restricted or paused.
Send requests to the email in section 1. For students under 18, the request is made by the parent or guardian recorded at registration. Requests must come from the registered email or WhatsApp number so we know the requester is genuine.
We respond within 3 x 24 hours of receiving a request. Students can also see their own scores at any time in the student portal.
If consent is withdrawn, portal access is closed and the data is handled as requested; processing before the withdrawal remains lawful. Data we must keep by law, such as payment receipts, is kept until its retention period ends.
If you are not satisfied with our response, you may complain to the authority responsible for personal data protection.
8. Security
- Every admin has their own account with permissions for their role and must use two-step verification.
- The app uses a database account with limited rights.
- Login cookies can be read only by the server and are sent only over HTTPS; login attempts are limited.
- All connections use HTTPS, and database backups are encrypted.
- Admin actions are logged; student contacts are downloaded only when chosen, and the download is logged.
9. Data breaches
forBio's owner leads the response. Within 3 x 24 hours of learning of a breach, we notify affected students and parents or guardians by email and WhatsApp, and the responsible authority. The notice states what data was exposed, when and how, what we have done, and who to contact.
10. Changes
Changes are posted on this page with a new version number and effective date. Important changes are also announced by email or WhatsApp before they take effect.